Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 151:

  During a Level 2 Assessment, an OSC provides documentation that attests that they utilize multifactor authentication on nonlocal remote maintenance sessions. The OSC feels that they have met the controls for the Level 2 certification. What additional measures should the OSC perform to fully meet the maintenance requirement?

  A. Connections for nonlocal maintenance sessions should be terminated when maintenance is complete.
  B. Connections for nonlocal maintenance sessions should be unlimited to ensure maintenance is performed properly
  C. The nonlocal maintenance personnel complain that restrictions slow down their response time and should be removed.
  D. The maintenance policy states multifactor authentication must have at least two factors applied for nonlocal maintenance sessions.
  A. Connections for nonlocal maintenance sessions should be terminated when maintenance is complete.

• Question 152:

  In CMMC High-Level scoping, which definition BEST describes an HQ organization?

  A. The entity that carries out the tasks under a contract
  B. The unit to which a CMMC Level is applied for each contract
  C. The teams, services, and technologies that provide support to a Host Unit
  D. The entity legally responsible for the delivery of products or services under a contract
  D. The entity legally responsible for the delivery of products or services under a contract

• Question 153:

  An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being completed quarterly. During the interviews, the team members say they perform the practice monthly but only document quarterly. Is this sufficient to pass the practice?

  A. No, the work is not being done as stated.
  B. Yes, the practice is being done as documented.
  C. No, all three assessment methods must be met to pass.
  D. Yes. the interview process is enough to pass a practice.
  A. No, the work is not being done as stated.

• Question 154:

  During an assessment, the Lead Assessor reviews the evidence for each CMMC in-scope practice that has been reviewed, verified, rated, and discussed with the OSC during the daily reviews. The Assessment Team records the final recommended MET or NOT MET rating and prepares to present the results to the assessment participants during the final review with the OSC and sponsor. As a part of this presentation, which document MUST include the attendee list, time/date, location/meeting link, results from all discussed topics, including any resulting actions, and due dates from the OSC or Assessment Team?

  A. Final log report
  B. Final CMMC report
  C. Final and recorded OSC CMMC report
  D. Final and recorded Daily Checkpoint log
  D. Final and recorded Daily Checkpoint log

• Question 155:

  A Lead Assessor is planning an assessment and scheduling the test activities. Who MUST perform tests to obtain evidence?

  A. OSC personnel who normally perform that work as the CCP observes
  B. Military personnel and the CCP and/or Lead Assessor to test the adequacy of the written procedure(s)
  C. Military personnel assigned to the contractor for that contract to ensure the confidentiality of the CUI
  D. OSC personnel who do not ordinarily perform that work to evaluate the accuracy of the written procedure(s)
  A. OSC personnel who normally perform that work as the CCP observes

• Question 156:

  How does the CMMC define a practice?

  A. A business transaction
  B. A condition arrived at by experience or exercise
  C. A series of changes taking place in a defined manner
  D. An activity or activities performed to meet defined CMMC objectives
  D. An activity or activities performed to meet defined CMMC objectives

• Question 157:

  Which NIST SP discusses protecting CUI in nonfederal systems and organizations?

  A. NIST SP 800-37
  B. NIST SP 800-53
  C. NIST SP 800-88
  D. NIST SP 800-171
  D. NIST SP 800-171

• Question 158:

  Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?

  A. Access control
  B. Physical access control
  C. Mandatory access control
  D. Discretionary access control
  A. Access control

• Question 159:

  A contractor provides services and data to the DoD. The transactions that occur to handle FCI take place over the contractor's business network, but the work is performed on contractor-owned systems, which must be configured based on government requirements and are used to support a contract. What type of Specialized Asset are these systems?

  A. loT
  B. Restricted IS
  C. Test equipment
  D. Government property
  B. Restricted IS

• Question 160:

  A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what will the CCP ensure about the information exchanged during the interview?

  A. Performed in groups for more efficient use of resources
  B. Recorded for inclusion in the Final Recommended Findings report
  C. Confidential and non-attributable so interviewees can speak without fear of reprisal
  D. Mapped to specific CMMC practices to clearly delineate which practice is being evaluated
  C. Confidential and non-attributable so interviewees can speak without fear of reprisal